Access and permissions

Access decides who can open each table, view and page in your workspace, and what they can do there. Nobody sees anything you have not given them, apart from the workspace's Super Admins.

The four parts

• Members are people with a Sterodata account who belong to the workspace. You invite them by email. See Members and roles.
• Roles are named groups, such as Finance or Support. A role gives nothing by itself: it holds whatever you share with it, and every member who has the role gets that.
• Grants are what you give on one table or view, to a person or a role, at one of three levels: Viewer, Editor or Owner. You give them on the table's Share sheet. See Share a table or view.
• Links open one table, view or page for whoever holds them, with no account. See Share links.

Rights add up. A person gets everything given to them directly and everything given to each of their roles.

What a Super Admin can always do

Whoever creates a workspace is its first Super Admin. A Super Admin holds every right on everything in the workspace: they open and change every table, view and page, share them, invite and remove members, create roles and change Settings. Field limits never apply to them. Share sheets do not list them, because nothing on a sheet could add to or take away from what they have.

A workspace always keeps at least one Super Admin. The last one cannot be removed or lose the role, and only a Super Admin can make someone else a Super Admin.

What everyone else starts with

Every member has the User role. It starts with no access, so a new member sees nothing until a table, view or page is shared with them, with User, or with another role they hold. Apps you install can add roles of their own, with what the app gives them (see Apps).

Narrower than a table

• Limit the fields a role or person sees on a table they can view.
• Show each person only their own rows with a view filtered to whoever is reading.

People without an account, and the record of who did what

• Guests without an account: what they can open, and the setting that turns guest access off.
• Who changed what: who created and last changed each record, and who deleted each table and field.

For a full setup in order, from roles to links with an end date, read How to give each person access to only what they need.

In this section

• Members and rolesInvite people with the roles they need, follow an invitation until it is accepted, change a member's roles or remove them, and create the roles your team works in.
• Share a table or viewGive a person or a role Viewer, Editor or Owner on a table or view from its Share sheet, and read back who has access to it.
• Limit the fields a role or person seesNarrow a Viewer's access to chosen fields of a table from its Share sheet, so a role such as Support reads the records without the columns it should not see.
• Show each person only their own rowsMake a view filtered to the person reading it, share the view with a role instead of the table, and each member sees only the records that name them.
• Share linksSend a table, view or page to people without an account through a link, set the day it stops working, see how often it was opened, limit its columns, and revoke it.
• Guests without an accountWhat people who are not signed in can open and do in your workspace, how their changes are recorded, and the setting that turns guest access off.
• Who changed whatEvery record in the built-in database shows who created it, who last changed it and when, and the trash shows who deleted each table and field.